Linux-Forensics

Cisco Talos and others report that Kraken now profiles each host to select encryption mode and threading. Here’s a concise IR playbook fo...

Kraken ransomware adds CPU/IO benchmarking—what to hunt before the encryptor runs

4n6 Beat
5 min read

On November 13, 2025, reporting highlighted that the cross-platform Kraken ransomware profiles victim machines first, benchmarking disk/CPU to choose between full or partial encryption and tune threads to avoid tripping resource alarms BleepingComputer. Cisco Talos’ deep dive confirms host-side performance tests via a temporary file and command-line switches, plus distinct encryptors for Windows and Linux/VMware ESXi that append “.zpsc” and drop “readme_you_ws_hacked.txt” Talos. Talos also notes ties to the older HelloKitty operation and a Kraken-hosted forum announcement (“The Last Haven Board”), a link also observed by independent analysis of Kraken’s leak site Talos Cyjax.

Shufflecake hides multiple encrypted filesystems inside apparent free space on Linux. Here’s how it works, what deadbox can’t tell you, a...

Shufflecake on Linux: what deniable, multi-layer volumes mean for DFIR

4n6 Beat
6 min read

Shufflecake implements plausible deniability on Linux by scattering several independently-keyed volumes across what looks like random free space, making both the existence and the number of volumes hard to prove in deadbox exams. The design ships as a device-mapper target (kernel module) plus a userland CLI, with volumes exposed as virtual block devices under /dev/mapper when opened (Shufflecake project site). The project originated at Kudelski Security and EPFL in November 2022 (Kudelski Security blog), and the research was later peer-reviewed at ACM CCS 2023 (Shufflecake ePrint).